astro
7.4.12The web framework for content-driven websites.
- Maintenance
- Active699 commits in 3 months · bus factor 5
- License
- OtherUnknown
- Security
- 30 advisories1 critical, 3 high, 15 medium, 11 low
- Supported versions
- No scheduleendoflife.date does not track this project
64k stars · 3.9k forks · 118 open issues · last release 1 day ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 1 critical, 3 high, 15 medium, 11 low. Check the patched version against the one you run.
- lowCVE-2026-126364Nov 9, 2026Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
- Affected
- <= 11.1.11; >= 5.14.3, <= 7.4.6
- Patched in
- 7.4.7
- lowCVE-2026-126361Nov 9, 2026XSS via attribute injection in dynamic tag names
- Affected
- <= 7.4.4
- Patched in
- 7.4.5
- mediumCVE-2026-126365Oct 28, 2026XSS via unescaped code for unsupported languages in @astrojs/prism
- Affected
- <= 4.1.1; >= 0.3.0, <= 2.1.1
- Patched in
- 4.1.2; 2.1.2
- mediumCVE-2026-126363Oct 28, 2026Reflected XSS via unescaped slot names in @astrojs/solid-js
- Affected
- >= 0.2.0, <= 7.1.1
- Patched in
- 7.1.2
- mediumCVE-2026-126362Oct 28, 2026Reflected XSS via unescaped slot names in @astrojs/svelte
- Affected
- >= 5.7.3, <= 9.1.1
- Patched in
- 9.1.2
- mediumGHSA-m8p5-r7qv-cx4cOct 12, 2026Full-read SSRF in the default `/_image` endpoint via the same Host header
- Affected
- <= 11.1.6
- Patched in
- 11.1.7
- mediumCVE-2026-114128Oct 12, 2026XSS via unescaped dynamic content in JSX and MDX script or style elements
- Affected
- < 7.3.2
- Patched in
- 7.3.2
- lowCVE-2026-114127Oct 12, 2026Arbitrary CSS injection in Astro View Transitions
- Affected
- >= 7.1.0, <= 7.3.2
- Patched in
- 7.3.3
- criticalGHSA-26w7-cxv4-gfx2Aug 27, 2026Remote code execution through AVIF image optimization
- Affected
- < 7.2.8
- Patched in
- 7.2.8
- mediumCVE-2026-102983Aug 27, 2026Netlify Image CDN allowlist bypass enables SSRF
- Affected
- >= 5.2.0, <= 8.2.3
- Patched in
- 8.2.4
- mediumCVE-2026-84376Aug 27, 2026Authorization bypass from missing path-segment boundary check when stripping the configured base
- Affected
- <= 7.2.3
- Patched in
- 7.2.4
- lowCVE-2026-102984Aug 27, 2026Malformed port in the Host header can crash the Node adapter
- Affected
- <= 11.1.2
- Patched in
- 11.1.3
- mediumCVE-2026-73422Jul 17, 2026Reflected XSS via unescaped View Transition animation properties
- Affected
- >= 2.9.0, <= 7.0.9
- Patched in
- 7.1.0
- lowCVE-2026-73423Jul 17, 2026composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
- Affected
- >=7.0.0
- Patched in
- 7.0.5
- lowCVE-2026-59729Jul 17, 2026XSS via unescaped spread attribute names in custom element rendering
- Affected
- <=7.0.3
- Patched in
- 7.0.5
- lowCVE-2026-59727Jul 17, 2026Cross-site scripting via unescaped transition:* directive values on hydrated islands
- Affected
- >= 3.10.0, < 7.0.4
- Patched in
- 7.0.4
- mediumCVE-2026-73424Jul 17, 2026Unauthenticated path override in the @astrojs/vercel ISR function
- Affected
- >= 10.0.3
- Patched in
- 11.0.3
- lowCVE-2026-73425Jul 15, 2026@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
- Affected
- <= 8.1.1
- Patched in
- 8.1.2
- lowCVE-2026-59730Jul 15, 2026Backslash-prefixed paths not recognized as internal by trailing-slash redirect in @astrojs/node
- Affected
- >=8.1.0, <=11.0.0
- Patched in
- 11.0.2
- mediumCVE-2026-59728Jul 15, 2026XML injection in @astrojs/rss via unescaped source and enclosure fields
- Affected
- >=1.0.0
- Patched in
- 4.0.19
- highCVE-2026-59731Jul 1, 2026Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
- Affected
- 6.4.7
- Patched in
- 6.4.8
- mediumCVE-2026-54298Jun 12, 2026XSS via Unescaped Attribute Names in Spread Props
- Affected
- <= 6.4.2
- Patched in
- 6.4.6
- highCVE-2026-54299Jun 12, 2026Host header SSRF in prerendered error page fetch
- Affected
- <= 6.4.4 (core; the chain is present on main HEAD)
- Patched in
- 6.4.6
- mediumCVE-2026-54300Jun 12, 2026@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
- Affected
- <= 7.0.10
- Patched in
- 7.0.13
- highCVE-2026-50146Jun 12, 2026Reflected XSS via unescaped slot name
- Affected
- 6.3.1
- Patched in
- >= 6.3.3
- lowCVE-2026-45028May 7, 2026Server island encrypted parameters vulnerable to cross-component replay
- Affected
- < 6.1.10
- Patched in
- 6.1.10
- lowCVE-2026-41321Apr 20, 2026SSRF via redirect following in Cloudflare image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
- Affected
- <= 13.1.6
- Patched in
- 13.1.10
- mediumCVE-2026-41067Apr 20, 2026XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
- Affected
- <= 6.1.1
- Patched in
- 6.1.6
- mediumCVE-2026-41322Apr 20, 2026Cache Poisoning due to incorrect error handling when if-match header is malformed
- Affected
- < 10.0.5
- Patched in
- 10.0.5
- mediumCVE-2026-33768Mar 24, 2026Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
- Affected
- <= 10.0.0
- Patched in
- 10.0.2